Claude · blog.modelcontextprotocol.io
Zero-Touch OAuth for MCP
Compiled by KHAO Editorial — aggregated from 1 source + 1 reference discovered via search. See llms.txt for citation guidance.
◌ Single Source
Hacker News is excited for more identity providers, clients, and servers to adopt Enterprise-Managed Auth to help reduce the authorization-related fatigue and significantly improve the security and observability posture for its implementers.
Key facts
- Enterprise-Managed Authorization is the work of the MCP community: the authors of SEP-990, the maintainers of the ext-auth repository, and the identity and MCP providers who tested early
- Under the hood, the client obtains an Identity Assertion JWT Authorization Grant (ID-JAG) from the IdP during single sign-on and exchanges it for an access token from the MCP server’s authorization
- The Enterprise-Managed Authorization (EMA) extension is now stable
- Enterprise-Managed Authorization makes the organization’s IdP the authoritative decision-maker for MCP server access
Summary
Authorize once, inherit everywhere. The Enterprise-Managed Authorization extension is now stable. EMA allows organizations to control MCP server access centrally through their trusted identity provider. The standard MCP authorization model was designed to be user-scoped and bound to the traditional interactive auth conventions.